Downloading firmware to the RCX

Kekoa Proudfoot explains the download process:

I assume you know the basic packet protocol. If not, it was described by Dave Baum.

1. Read in the s-record file

   See http://graphics.stanford.edu/~kekoa/rcx/s-record.txt for a description of the format that somebody else wrote up.

   After this, you should have an image with a starting address and an ending address.

   If you like, search from the ending address backward until you find the first non-zero byte, and make that the new ending address. This is not entirely legal, because maybe that data was supposed to be set to zero, but it speeds downloading, and it works with the supplied Firm0309.lgo.

2. Find the checksum of the image

   Add up the bytes between the starting and ending address. You checksum should be an unsigned short. A short has 16 bits.

3. Send a delete firmware message

   In hex, the data in the message should be:

         65 01 03 05 07 0b

   You need to supply the header, complement, and checksum bytes.

4. Send a start firmware download message

   In hex, the data in the message should be:

         75 00 80 cc dd 00

   cc is the least significant byte of the image checksum

   dd is the most significant byte of the image checksum

5. Send the image data using transfer data messages

   Break up the image into 200 byte chunks.

   Loop over the chunks. Compute the checksum for the current chunk by adding up the bytes of the current chunk. This checksum should be a byte, not a short.

   For each chunk, send a message with the following data (in hex):

         xx aa bb cc dd databytes ee

   xx is the message opcode
   aa is the least significant byte of the index of this chunk
   bb is the most significant byte of the index of this chunk
   cc is the least significant byte of the size of this chunk
   dd is the most significant byte of the size of this chunk
   databytes are the data bytes in this chunk
   ee is the checksum byte of this chunk
   The opcode should alternate between 45 and 4d with every other chunk
   The index should start at 1 and increase by 1 with each successive chunk
   The last chunk should have an index of 0
   
6. Send an unlock firmware message

   In hex, the data in the message should be:

         a5 4c 45 47 4f ae

That's it.

Sending messages is non-trivial. First you have to configure the serial port. Then, when you send a message by writing data to the serial port, you have to wait for a proper reply to make sure the rcx received it. If you do not receive a proper reply, send the exact same message again until you do hear a proper reply.

There's more information on messages and the serial protocol.

With all of this in mind, the download trace should make sense.

A few things to note about the trace:

• opcodes alternate between having the 0x08 bit set and clear
• the apparent RCX echo is really the caused by the IR tower
• the trace includes some extra commands (10,18) that aren't strictly needed

Hope this helps,

-Kekoa